
where \(f_{\theta }\)  is the DNN model, and \(\Delta (x)\) 
is the set of allowable perturbations with a radius \({\epsilon }\)  measured with respect to the metric \(d\) . Early works assume that \(\Delta (x)\)  is the \(\ell _p\)  norm ball intersected with the natural image box, i.e., \(\lbrace x^{\prime } \in [0, 1]^n: \left\Vert  x- x^{\prime } \right\Vert _{_}p \le {\epsilon }\rbrace \) , where \(p= 1, 2, \infty \)  are popular choices [1]}, [2]}. To capture visually realistic perturbations, recent work has also modeled nontrivial transformations [3]} that use non-\(\ell _p\)  metrics. For empirical robustness evaluation (RE), solving eq:robustloss leads to the worst perturbations that could fool \(f_{\theta }\) .
